Introduction 


Thanks to the NTIA for conducting this initiative, and for including me in the conversation. 


Part 1 — The Role of the NAI and Privacy Self-Regulation 


The NAI promotes the health of the online ecosystem by maintaining and enforcing high 
standards for the collection and use of data for digital advertising. 


We’re proud that our industry-leading Code of Conduct includes an outright prohibition against 
the secondary use of information collected for Tailored Advertising for certain eligibility 
purposes, including credit, insurance, housing, and education, regardless of whether such 
information is ever sold, and even when a consumer has not opted out of Tailored Advertising. 


We believe that maintaining a robust, ad-supported digital media ecosystem is not in conflict 
with the objectives of increasing privacy, enhancing protections for civil rights, and avoiding 
harmful outcomes. 


The NAI has recently engaged its members and key stakeholders to identify steps to mitigate 
risks to privacy and civil rights. We remain committed to raising industry awareness, promoting 
industry standards and practices that increase transparency, and working with members and 
their business partners to adequately evaluate and mitigate disparate impacts. 


Part 2 — Unique Challenges We Must Move Beyond 


Collectively, we must overcome several challenges in order to make trust and accountability the 
foundations of digital advertising. 


1. First, privacy self-regulation has limitations. The NAI has worked for many years to 
establish privacy guidelines, and we have significantly enhanced protections for 
consumer data. But ultimately, self-regulation increasingly forces the best-intentioned 
companies to compete with others who maintain lower standards. 


2. Second, the “Notice and Choice” framework must evolve. The notion of consumers 
serving as the primary guardians of their data is simply not pragmatic given the wide 
range of data-driven products and services that power our modern lives and the digital 
economy. 


3. Third, broad bans on data collection and use are simply impractical, and undesirable. 
There are many cases where these data types are utilized to reach at-risk communities 
and promote beneficial products and services, and increase diversity. Most recently, 
tailored advertising was effectively deployed by health organizations to reach at-risk 
populations and educate them about the value of COVID vaccines. 


4. Finally, the emerging state patchwork is a well-intended stopgap, but is not in the best 
interest of either consumers or businesses. 


Part 3 - The Path Forward 


The NAI and our members recognize the need to do more, both within industry, and by 
enacting a comprehensive national consumer privacy framework that provides strong, uniform 
protections for all U.S. consumers, a uniform set of rules for businesses, and consistent 
enforcement. 


Data Protection Assessments 


Data Protection Assessments (DPAs) are essential to responsible data processing - they identify 
and minimize risks posed by the collection and processing of personal data, not just in the 
digital advertising industry, but also more broadly. 


DPAs have become a common practice for many companies operating in Europe, and they are 
also critical elements of the consumer privacy laws recently passed in the US. As these practices 
become more common, we need to ensure that they can act as an important protection for civil 
rights objectives, as well as privacy. 


In response to these new requirements, the NAI has begun mapping DPA elements to digital 
advertising practices, building on core NAI compliance requirements as the foundation, with a 
critical focus on avoiding harmful and disparate outcomes from data-driven advertising. 


We believe the NAI is well suited to help develop and implement best practices, including risk 
assessments, across the digital advertising industry to ensure individual rights and freedoms 
are continually protected. 


What we need most is to Establish a National Consumer Privacy Framework 


While the new state law requirements for DPAs are a critical step forward, they have different 
standards and requirements. A national framework could help to streamline and extend these 
essential data protections for consumers across the country. 


NAI is a founder and leading member of the Privacy for America Coalition, an industry group 
supporting a national privacy framework that would establish a “new paradigm,” that identifies 
and prohibits certain practices as “unreasonable” and provides for enhanced enforcement, 
among other protections. 


This approach is in many ways consistent with the proposals to adopt a set of responsibilities 
for companies that handle personal data, such as duties of care and loyalty. We believe that 
clear definitions of prohibited practices, combined with strong enforcement, will help ensure 


consumer and business trust in data use, and create a framework for responsible corporate 
action. 


The Privacy for America framework includes key elements that seek to minimize discrimination 
and civil rights violations, such as a codification of the NAI’s prohibition on the use of personal 
data for eligibility decisions for employment, credit, insurance, health care, educational 
admissions, financial aid, or housing, and a ban on the use of personal data to charge higher 
prices based on demographic characteristics. In addition, the Framework would empower the 
FTC and state attorneys general with enhanced enforcement authority of anti-discrimination 
laws. 


Finally, the Framework would establish a model for effective co-regulation by creating FTC 
certification programs, including rigorous standards and oversight by the FTC to ensure, as 
efficiently as possible, that companies are complying with legal requirements. 


Conclusion 

Again, thank you for the opportunity to participate, and we look forward to continuing this 
discussion with the Biden Administration, members of Congress, and other key policymakers 
and stakeholders. 


